PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API

published 2026-06-18 4 mo ago modified 2026-10-23 16 d ago also EUVD-2026-108895 , GHSA-rh39-9c67-59mh , PYSEC-2026-3526

cvss: 8.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits: 0; none known

PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label attachments — created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. A single malicious or compromised member account can wipe an entire workspace's content irreversibly. This issue has been patched in version 0.1.5.

Patch / fix

fixed in 2

pypi praisonai-platform 0.1.6
praison praisonai 0.1.5

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 16 d ago (2026-10-23)

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
GitHub	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
OSV	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	praisonai-platform	>=0.1.4, <0.1.6	0.1.6

Affected products

MervinPraison PraisonAI

Classification

Weakness

CWE-285 Improper Authorization

References

github.com /MervinPraison/PraisonAI/security/advisories/GHSA-rh39-9c67-59mh
web
github.com /MervinPraison/PraisonAI
package
pypi.org /project/praisonai-platform
package
github.com /advisories/GHSA-rh39-9c67-59mh
advisory
nvd.nist.gov /vuln/detail/CVE-2026-57121
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary